4 ms·
I wish synk (and npm audit) would do a better job of providing simple explanations to when these vurnabilities actually pose a threat. It's impossible for devs
by cjonas 7y ago
I wish synk (and npm audit) would do a better job of providing simple explanations to when these vurnabilities actually pose a threat. It's impossible for devs to keep up with the constant flood of vurnabilities. Does it matter if a dependency that I'm use in my build tooling is open to reDos? I honestly do not know because I don't have time to study each of these issue. Instead I just try to upgrade as often as possible, but maybe not as often as I should if I knew there were actually security holes in my runtime application
- danenania 7y agoYeah, somewhere in the reporting/auditing workflow, there should probably be a flag distinguishing whether vulnerabilities are actually dangerous in a devDependencies context (they rarely are). I find that jest and webpack especially generate tons of these irrelevant "vulnerabilities" and it's really annoying. It's a security issue too since it leads people to start ignoring the audit output.
- L84Dinner 7y agoI work on this project, so I'm biased, for sure, but why not take a gander at: https://github.com/sonatype-nexus-community/auditjs https://github.com/sonatype-nexus-community/auditjs By default we exclude devDeps (allowing you to run that later). The project functions off EXACTLY what you have installed in your node_modules, so it's a pretty accurate look at your actual risk profile. You can run it with --dev to get a look at your dev Deps, but we tailored it by default to your "prod risk profile". The notes y'all make are pretty much why. Every Dev Dep in the world seems to use lodash, so yeah, we get it, it can be prototype polluted, tell me what my actual risk is!
- danenania 7y agoNice, will check it out!